The most serious concern for many operators involves any BIND server that answers DNS-over-HTTPS (DoH) queries. An unauthenticated sender can crash the named server process with a single request containing an invalid SIG record. No credentials are required, making this remotely triggerable by anyone who can reach the DoH endpoint.

Affected releases:

• BIND 9.20.29 and 9.21.26 contain the fixes
• Administrators running earlier versions in those branches should upgrade promptly

Given that the DoH crash needs only one malformed request, patching should be treated as high priority, particularly for any deployment exposing DoH to untrusted networks. There is no indication of a workaround in the advisory, so upgrading to the fixed versions is the recommended path.

Source: The Hacker News

Does your organization run BIND with DoH enabled, and are you planning to upgrade to 9.20.29 or 9.21.26 right away?